Generally described, electronic security monitoring networks utilize programmatic rules to identify and trigger reactions to event conditions. For example, a monitoring system might be configured to activate video recording or to sound an audible alarm when a motion sensor has detected movement within a monitored premises. However, conventional systems lack the ability to “learn” from the data that is collected to enable adaptive response. For example, perhaps a certain amount of movement within a given premises is “normal” or expected for a certain time of day and instead of triggering a motion sensor alarm, it would be preferable to ignore or tolerate that motion. It would clearly be advantageous for a monitoring system to react to only movement that differs from the norm. Thus, there is a need for a monitoring system that can use self-learning rules to provide adaptive security monitoring.